Risk based approach to managing privacy (EDPD 2015)
•
0 likes•221 views
Risk-based approach slides from European Data Protection Days 2015 in Berlin.
Recommended
Recommended
More Related Content
Viewers also liked
Similar to Risk based approach to managing privacy (EDPD 2015)
Similar to Risk based approach to managing privacy (EDPD 2015) (20)
Recently uploaded
Recently uploaded (20)
Risk based approach to managing privacy (EDPD 2015)
- 1. 1 © Nokia 2015 RISK-BASED APPROACH Managing privacy in a complex global technology business “European Data Protection Days” Conference, 4-5 May 2015 Oskari Rovamo, Global Privacy Counsel Nokia Corporation
- 2. 2 © Nokia 2015 HERE Nokia Technologies Nokia Networks NOKIA REINVENTED
- 3. 3 © Nokia 2015 GROUP-WIDE PRIVACY RISK CONTROL FRAMEWORK Responsible for Implementing the Policy and Program, SOP’s. Privacy Owners and Officer(s). Responsible for Policy, Program, Objectives, Group wide requirements and processes, Support Accountable for Nokia Privacy Policy and Program. Sufficiently independent. Nokia Privacy Owner Nokia Group Privacy Officer Networks HERE Technologies Corporate Functions Cross-teams: Security, Legal & Compliance, Enterprise Risk Management, Government Relations, Human Rights, Industry outreach, External Communications 1. Executive Accountability 2. Policies and processes 3. Staff, resources 4. Training and awareness 5. Risk assessment and mitigation 6. Issue response 7. Internal enforcement
- 4. 4 © Nokia 2015 NOKIA PRIVACY VISION AND PRINCIPLES Aligned with globally recognized privacy frameworks. Serves as the basis for more detailed standard operating procedures, requirements, guidelines and design patterns. We respect privacy Accountable, fair and lawful processing Privacy by Design Transparency, choice and individual participation Collection and purpose limitation Data management Limited and controlled disclosures Security safeguards
- 5. 5 © Nokia 2015 KNOW YOUR RISKS, THEN MITIGATE THEM Principles Threats, Harm Residual Risk Risk Different privacy analysis approaches: • Goal-oriented • Risk-based • Combination/hybrid Controls Requirements
- 6. 6 © Nokia 2015 WHAT PRIVACY ANALYSIS APPROACH DO YOU USE? a) Goal-oriented e.g. processes where defined, repeatable and easy- to-follow privacy requirements are turned into privacy controls. b) Risk-based e.g. privacy impact assessment is used to identify treats and harm as well as to determine the risk; privacy controls proposed to treat the risk. c) Combination/hybrid e.g. processes combine both goal-oriented and risk-based approaches. d) Other/none e.g. no privacy analysis is done.
- 7. 7 © Nokia 2015 PRIVACY ENGINEERING & ASSURANCE COMPONETS Principles, Statements, Requirements, Procedures, Guidelines, Patterns Planning & Concepting Threat Assessment and Mitigation Privacy requirements identification Design, Implement, Test Map privacy requirements into product features Select guidelines, patterns Review Against requirements Can be standalone Release Assessment Sign-off Evidence Evidence Privacy Engineering Privacy Assurance Privacy Knowledge Base Evidence
- 8. 8 © Nokia 2015 THANK YOU!